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CLAIMS 

1 . A cryptographic method during which use is 
made of a random number generator producing random 

5 numbers Si of size N fixed between 0 and W-l, in order 
to produce a random number R between 0 and a predefined 
limiter K, characterised in that: 

E31: a random variable Si between 0 and W-l is 
produced, 

10 E32 : if the random variable Si is strictly less 

than a coefficient Ki of the limiter K in base W, then 
the coefficient Ri of rank i of the random number R is 
equal to the random variable Si and then, for any rank J 
less than i, a random variable Sj between 0 and W-l is 

15 produced and Rj = S j , 

E33: otherwise, if the said random variable is 
greater than the coefficient Ki of rank i of the limiter 
K in base W, then the said coefficient Ri is determined 
from the random variable Si of rank i according to a 

20 predetermined function, and then the coefficient Ri-i is 
determined for the random number R of rank i-1 that is 
immediately lower by repeating steps E31 to E33 . 

2. A method according to claim 2, during which 
the following steps are performed: 

25 El: the limiter K is decomposed in base (W p_1 , W p " 2 

W°) in the form K = ^K i *W i , i being a loop index, 

1=0 

Ki being a coefficient of the limiter K of rank i 
between 0 and W-l and p being the degree of the limiter 
K, 
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E2 : a Boolean variable f is initialised to TRUE, 
E3 : the following operations are performed, in a 

loop indexed by i, i being an integer varying between 

p-1 and 0: 

E31: a random variable Si between 0 and W0-1 
is produced, 

E32 : if the random variable Si is strictly 
less than the coefficient Ki of rank i, then the 
Boolean variable f is set to FALSE, 

E33_l: if the random variable Si is strictly 
greater than the coefficient Ki of rank i and the 
Boolean variable f is TRUE, then the coefficient Ri 
of rank i is determined from the random variable Si 
of rank i according to a predefined function, 
E33_2: otherwise Ri = Si 

E34 : the loop indexed i is decremented, 

E4 : the random number R is determined by 

recombination of the random coefficients Ri in base W 

p-i 

according to the equation: R = ^T i R i *W l . 

i=0 

3. A method according to claim 2, during which, 
in order to determine the coefficient Ri of rank i from 
the random variable Si of rank i (steps E3 3_l and 
E33_2) , the following substeps are performed: 

E33__ll: if the random variable Si is strictly 
greater than the coefficient Ki of the limiter K, then a 
new random variable Si is produced, 

E33__12 : step E33__ll is repeated until the random 
variable Si is less than the coefficient Ki of the 



15 



limiter K, and then the coefficient Ri is equalised to 
the random variable Si. 

4. A method according to claim 2, during which 
the coefficient Ri of rank i is chosen (steps E33-1 and 

5 E3 3_2) equal to the part of the random variable S ir the 
part less than the coefficient Ki, the said part 
corresponding to a limited number of bits of the 
variable Si . 

5. A method according to claim 2, during which, 
10 in order to determine the coefficient Ri of rank i from 

the random variable Si of rank i (step E33) , the random 
variable Si is reduced modulo Ki+1, the result of the 
reduction being the coefficient sought. 

6. A method according to one of claims 1 to 5, 
15 during which, in order to determine the coefficient Ri 

of rank i from the random variable Si of rank i (step 
E33), steps El to E4 are executed using a base (p q_1 , 
. . . , p°) as the calculation base, P being an integer 
strictly less than W and q being the degree of k in 
20 case p. 

7. A method according to claim 6, in which step 
E33 is broken down into the following substeps : 

E33_41: the coefficient Ki of rank i of the 
limiter K in base (p q_1 , .-./ P°) in the form 
£\ 

25 K x = 2j(^ ( ) y * P J / j being a loop index, (Ki) j being a 

7=0 

number between 0 and P-l and q being a degree of the 
coefficient Ki, is decomposed, 
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E33_42: a second Boolean variable g is 
initialised to TRUE, 

E33_43: the following operations are performed, 
in a loop indexed by j varying between q-1 and 0: 
5 E33_431: a random variable (Si)j between 0 

and p-1 is produced, 

E33_432: if the random variable (Si)j is 
strictly less than the coefficient (Ki)j, then the 
second Boolean variable g is set to FALSE, 
10 E33_4331: if the random variable (Si)j is 

strictly greater than the coefficient (K±)j and the 
second Boolean variable g is TRUE, then a 
coefficient (R±)j is determined from the random 
variable (Si)j according to a predefined function, 
15 E33_4332: otherwise, (Rj.) j = (Si)j 

E33_434: the loop indexed j is decremented, 
E33_44: the random number R± is determined by 
recombination of the random coefficients (R±)j in base p 

according to the equation: R x = ^(R i ) J * fi J . 

7=0 

20 8. An electronic component comprising a 

generator of random numbers of size N, calculation 
circuits performing in particular a comparison, a 
truncation and/or a modular reduction on numbers of no 
more than N bits, and a means of controlling the random 

25 number generator and calculation circuits, the said 
control means being adapted for implementing a method 
according to one of claims 1 to 7 . 
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9. A chip card comprising an electronic 
component according to the preceding claim. 



